(Bug 4531): Group library JS/CSS separately from per-page JS/CSS, for better caching. Also set the scheme and library to have the same priority/ordering, so that they're grouped together when being printed
(bug 1716) Initial work on fuzzy tokens.
(bug 1716) Use bind vars instead of direct.
(bug 1716) Populate token where possible on notmodified
(bug3812) Add the sysban status + ban message to closed anon spamreports.

Patch by denise.
(bug4539) better priv checking for FAQ editing

Kareila found a weird case where faqedit:* worked but faqedit, no args,
didn't. On further investigation it looks like it's happening because
faqedit does priv checks weirdly. I pondered refactoring the priv
checks in the whole file but considering it's all going to TT soon, I
saved time and just threw in an explict check for faqedit: as well as
faqedit:*. Patch by denise.
(bug4544) Add quick needlogin for moodlist.bml

http://bugs.dwscoalition.org/show_bug.cgi?id=4544 -- exor674 mentioned
in comments to the bug that she's working on converting this to TT to
fix another bug, but since she's got so much on her plate I figured I'd
do a quick patch for the interim. This just adds a needlogin return at
the top of the page so logged-out users will be redirected. Patch by
denise.
(bug 4436) Missed a few places where we have "overlays"
(bug 4431) Add ability to smart redirect to SSL version of page.
(bug 4087) Refactor backend auth code.
(Bug 4570) Inactivate userpics

In order to import everything we can, right now we allow the importer to
exceed the user's userpic quota. This adds a nightly update that goes in and
makes sure the userpic quotas are respected.

This runs as part of the nightly active user job, so it means users will have
up to 24 hours of time above the quota before we fix it.
(bug 4436) Fix Lang.pm warning
Corrected a comment - not all CAPTCHAS are because of rate-limiting.
Added explanatory comments to CAPTCHA options.
(Bug 4436) Fix redirects of /dir to /dir/index
Changed textcaptcha to use the form it's passed rather than the http
request. Added code to handle odd ways of passing textcaptcha_challenge.

It doesn't work in all places though....
We had been using lj_form_auth in validating the captcha, but not
actually asking anybody to pass it to us. Now we include it in the list
of variables we need.
Tidy up
(bug 4399) Crush PNGs
Allow for the noscript version of things. Doesn't always work though...